CAB Signature Format: Specification & Recovery Example

File version, two bytes at offset 24, must be 0x01, 0x03.
File size is defined at offset 8, however if additional header exists, this size is not valid.
Two bytes at offset 30 is a flag defining whether additional headers exist, or not (bit 3).

If there are additional headers, size of the CAB archive file is calcualted as additional data offset plus additional data size.